Find design mistakes while changes are still cheap.
Winfunc builds a threat model from your design documents and from the code itself: assets, actors, data flows, trust boundaries, and entry points, with STRIDE-categorized threats ranked by what they expose. Open assumptions become focused hypothesis scans against the implementation.
- acme
- /billing-api
- /Threat model
- DisclosureInvoice ids are sequential and looked up without a tenantbilling-apiC
- SpoofingPayment webhook accepted without a signature checkwebhooksH
- ElevationSupport role can call the admin exportadmin apiH
- TamperingPlan price read from the client payloadcheckoutM
Security work should end in a decision, not another queue.
Architecture choices create security assumptions long before a scanner has code to inspect. Teams need a practical way to review assets, actors, data flows, and trust boundaries while a design can still change, and to keep that model current once the code exists.
- Design and code
- threats and assumptions
- mitigation plan
From scope to an engineering decision.
Connect the repository, and add a design document, diagram, or feature spec if the change is not built yet. Name the sensitive assets and the decisions that are still open.
- Scope01
Map actors, valuable assets, data flows, entry points, and trust boundaries
- Investigate02
Categorize threats with STRIDE and trace each to the components it touches
- Investigate03
Rank threats by exposure and recommend mitigations with owners
- Review04
Turn unresolved assumptions into hypothesis scans against the code
What your team gets.
- 01A data-flow and trust-boundary map
- 02Ranked threats and failure cases
- 03Mitigations and assumptions to test
- A data-flow diagram with trust boundaries, generated from code and design
- STRIDE-categorized threats ranked by exposure
- Security assumptions linked to the code that relies on them
- Mitigation options with their rationale and owners
- Hypothesis scans that test open assumptions in the implementation
Surface design flaws before they are built, and keep the model honest as the code changes.
Measure it
Track design issues resolved before implementation, mitigation completion, assumptions tested, and security-related rework per feature.
Scope and limits
A threat model reflects the design and code in scope at the time it was built. Winfunc keeps it current on each scan and turns open assumptions into tests, so the model and the implementation do not drift apart.
Explore connected capabilities
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.